From e81decac134199c67a9b17f656a168812d2e1133 Mon Sep 17 00:00:00 2001 From: kaizhe Date: Fri, 27 Sep 2019 12:00:18 -0700 Subject: [PATCH] rule update: fix missing entries Signed-off-by: kaizhe --- rules/falco_rules.yaml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml index 61625766..37a7f020 100644 --- a/rules/falco_rules.yaml +++ b/rules/falco_rules.yaml @@ -2421,6 +2421,11 @@ condition: > ((spawned_process and proc.name in (shred, rm, mv) and proc.args contains "bash_history") or (open_write and fd.name contains "bash_history" and evt.arg.flags contains "O_TRUNC")) + output: > + Shell history had been deleted or renamed (user=%user.name type=%evt.type command=%proc.cmdline fd.name=%fd.name name=%evt.arg.name path=%evt.arg.path oldpath=%evt.arg.oldpath %container.info) + priority: + WARNING + tag: [process, mitre_defense_evation] - macro: consider_all_chmods condition: (always_true)